The 10 biggest things in tech, Sat, Oct 3
The ten biggest stories in tech today, scored 1–10 and ranked from 150+ engineering sources. Free, updated every morning.
GitLab critical zero-day exploited
CVE-2026-85706, a CVSS 10.0 path-traversal vulnerability in GitLab versions 18.7–19.3.1, is under active exploitation in the wild, allowing unauthenticated attackers to read arbitrary files and steal secrets from any instance with at least one public project.
#1 · security · scored 9/10
AI accelerates exploit discovery risks
Multiple converging stories — Anthropic's Mythos model finding CVE-2026-61500 and triggering exploitation within 24 hours, GPT-4 exploiting 87% of benchmarked CVEs, and a GNOME developer urging AI-powered security scanning — show AI is collapsing the window between vulnerability disclosure and active exploitation, breaking traditional embargo models.
#2 · security · scored 8/10
Google donates gVisor to CNCF
Google donated its gVisor Linux sandbox project to the CNCF, transitioning governance to the community and targeting Incubation status, in a move to broaden adoption by decoupling gVisor's security model from the traditional VM-vs-container framing.
#3 · platform · scored 8/10
Developer supply-chain attacks surge
A targeted supply-chain attack used a malicious git post-checkout hook impersonating a development shop to steal GitHub credentials via a Vercel-hosted C2 binary, illustrating ongoing attacker focus on developer workflows and toolchains.
#4 · security · scored 7/10
China-linked cyber operations escalate
China-linked threat actor Warlock exploited Microsoft SharePoint vulnerabilities to deploy ransomware against critical infrastructure across Europe, Africa, and Latin America, while MI5 separately warned that China's MSS covertly funded research involving 100+ UK academics in AI and cybersecurity.
#5 · security · scored 7/10
AI agents trigger privacy backlash
Apple changed macOS full-disk access permissions to curb AI agent abuse after Meta's Muse accessed Apple Messages without explicit user awareness, while researchers exposed that Muse builds detailed hourly profiles of users' contacts — putting AI agent data access under sharp scrutiny.
#6 · security · scored 7/10
Flock ALPR faces legal and legislative pushback
A federal judge ruled Flock Safety's warrantless license plate reader network constitutes unconstitutional mass surveillance and suppressed obtained evidence, as Senator Bernie Sanders simultaneously introduced the Ban Flock Act to prohibit federal use of the company's 120,000+ camera network.
#7 · security · scored 7/10
India blocks Dorsey's Bitchat app
India ordered Apple to remove Jack Dorsey's encrypted Bitchat app from its App Store and blocked its website under Section 69A of the IT Act, targeting the app's ability to operate during internet shutdowns and resist law enforcement interception.
#8 · security · scored 7/10
Istio 1.31 ships ambient mesh features
Istio 1.31 delivers agentgateway waypoints for Layer 7 ambient mesh routing, zone-aware load balancing, FIPS-140-3 support, and migrates release artifacts off Google Cloud infrastructure to registry.istio.io.
#9 · platform · scored 7/10
Kagi Orion browser open-sourced
Kagi is open-sourcing its Orion WebKit-based browser for Linux and Windows, ceding those platforms to community stewardship while concentrating its own engineering on macOS and iOS.
#10 · frontend · scored 7/10